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Abstract 

We review the status of Bell's inequalities in quantum information, 
stressing mainly the links with quantum key distribution and distillation 
of entanglement. We also prove that for all the eavesdropping attacks 
using one qubit, and for a family of attacks of two qubits, acting on 
half of a maximally entangled state of two qubits, the violation of a Bell 
inequality implies the possibility of an efficient secret-key extraction. 



1 Introduction 

Quantum correlations were noticed to be astonishing by Einstein-Podolski- 
Rosen pQ and by Schrodinger [2] back in 1935. In particular, the EPR paper 
stressed that the predicted correlations could not be explained by exchange of a 
signal, since the entangled particles could be at an arbitrary distance from one 
another. If signal exchange is excluded, in the classical world we know only an- 
other mechanism to establish correlations: common preparation at the source. 
This second possibility was ruled out by John Bell in 1964 3 : the predicted 
quantum correlations violate a condition ( "Bell's inequality" , BI) that should 
hold if the correlations were established at the preparation. All the experiments 
performed since the Aspect experiment 0] in 1982 confirm quantum physics. 

Nowadays, although one should not forget the detection and locality loop- 
hole until their joint experimental test pj, for most physicists the debate on 
quantum correlations is closed: entanglement does exist, and moreover it has 
been recognized as a resource needed to perform tasks that would be classically 
impossible 6 . While nobody doubts that the interpretational content of the BI 
should shape any physicist's view of the world, it is not clear whether BI can 
be of interest for quantum information processing. We have investigated this 
question, since we believe that deep concepts and clever applications should not 
become two separate domains. 

This paper contains two separate sections: in section|21 we review the status 
of the Bell's inequalities in quantum information; in section [21 we present a 
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generalization of the link [7| between violation of Bell's inequalities and security 
of the quantum key distribution with qubits. 

2 The status of Bell's inequalities in quantum 
information 

2.1 BI and quantum cryptography 

The goal of quantum cryptography (quantum key distribution, QKD) is to pro- 
vide Alice and Bob with a secret key. An important result of classical cryptog- 
raphy says that if 

I(A : B) > min[I(A : E), I(B : E)\ (1) 

where I(X : Y) is the mutual information between X and Y , then a secret key 
can be extracted from the classical data (obtained by measuring the quantum 
systems) by efficient protocols using only one-way communication If that 
condition does not hold, in some cases a secret key can still be extracted, but 
all the known protocols are very inefficient. 

Consider QKD with entangled particles |H| , and let us start with the standard 
setting with two partners. Alice prepares the maximally entangled state, keeps 
one particle and sends the other one to Bob. In the absence of any spy on the 
line, whenever Alice and Bob measure in the same basis they obtain perfectly 
correlated random results. If the eavesdropper Eve has her own particles interact 
with the particle flying to Bob, the quantum state |* abe) becomes shared 
among the three actors, and the quantum information shared by Alice and Bob 
is given by the mixed state pab obtained by tracing out Eve's system. The 
connection with BI is as follows: in all the studied protocols, considering Eve's 
optimal individual attack, if pab violates a Bell's inequality, then £Q) holds. 

This link was first noticed for the four-state protocol with qubits \7\ , in which 
case actually the violation of the CHSH inequality is also a necessary condition 
for Q to hold. In section [3] we generalize this result. Protocols using higher- 
dimensional systems and/or more bases have also been studied, and in all these 
cases the condition seems only to be sufficient [HI] . 

A different extension has also been studied: the extension to protocols in- 
volving more than two partners. In such "quantum secret-sharing" protocols, 
Alice distributes random bits to N Bobs, that must cooperate in order to re- 
trieve the key. For protocols using qubits and two conjugated bases, it was also 
found 21] that a condition similar to Q holds if and only if the Mermin-Klyshko 
inequalities are violated. 

2.2 BI and distillation of entanglement 

Distillation of entanglement is a fundamental quantum information process. 
The entanglement of a quantum state p is distillable if, out of many copies 
of it, one can extract maximally entangled states (two-qubit singlets) using 
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only local operations and classical communication (LOCC). Operationally, this 
means the following: if a source S produces a state which is weakly entangled 
but distillable, then one can build a new source S', that is less efficient but 
produces strongly entangled states, by simply appending local devices to the 
ports of S and allowing the partners to communicate. In other words, if we 
have 5 1 , then we can build S ' and run any quantum information protocol like 
teleportation. The notion of distillability is not trivial because, in all quantum 
composed systems but C 2 <£> C 2 and C 2 ® C 3 , there exist so-called bound- 
entangled states, that are entangled but not distillable. 

We studied the link with BI in quantum systems composed of N > 2 qubits. 
In such a case, when the system is composed of more than two sub-systems, 
the notion of distillability is not even univoque. The strongest requirement is 
"full distillability" : any two partners can distill a singlet by LOCC. The weakest 
requirement is "bipartite distillability" : the N partners split into two groups 
of riA and ub = N — ua partners, and the state is distillable with respect to 
this partition h^/hb- Within each group, the most general transformations are 
allowed; but only classical communication is allowed between one group and the 
other. 

We have demonstrated |12j a quantitative link between this hierarchy or 
degree of distillability and the amount of violation of the WWZB inequalities 
that are the linear correlation inequalities with two settings per site. If a N- 
qubit state violates a WWZB inequality there is some distillable entanglement 
in the state; moreover, the amount of the violation is associated to the degree 
of distillability. In particular, a violation close to the maximal value, namely 
(B N ) e]2( Ar - 2 )/ 2 ,2( Ar " 1 )/ 2 ], guarantees full distillability of the state. A similar 
result holds for the Uffink inequality |14j . 

2.3 BI and communication complexity 

A "communication complexity" problem is the problem of computing a function 
whose inputs are distributed among several partners, who can exchange only a 
limited amount of information. In the quantum version of such protocols, some 
of the input information is replaced by quantum information, and the partners 
can share an entangled state. 

It has been shown in Ref. JS] that for every Bell's inequality and for a broad 
class of protocols, there always exists a multi-partite communication complexity 
problem, for which the protocol assisted by states which violate the inequality 
is more efficient than any classical protocol. Moreover, for that advantage, the 
violation of the BI is a necessary and sufficient criterion. 

3 CHSH and quantum key distribution with qubits 

In this section we will show the link between Bell violation and the security of 
QKD protocols for all one-qubit eavesdropping attacks and a family of two-qubit 
attacks. 
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Consider the situation in which Alice locally prepares a maximally entangled 
state of two qubits, |<I> + ) = ( 1 00) + |ll))/\/2, and sends one of the qubits to 
Bob by an insecure quantum channel. This qubit is intercepted by Eve, who 
performs the following attack: (i) she adds a one- qubit ancillary system in the 
state \E) and performs a unitary operation, Ube, over the two qubits and (ii) 
forwards one of the output qubits to Bob. Giving Eve just one qubit may appear 
as an exceedingly strong restriction; however, it is known that there exist a one- 
qubit attack such that I{A : E) reaches the value of the optimal individual 
eavesdropping on the BB84 protocol ^3 . We shall discuss below the role of 
I{B:E). 

After this attack, Alice, Bob and Eve share a three-qubit pure state, \^ ab e) € 
Ha^'Hb^'He- Note that this state has been obtained after interacting on half 
of a maximally entangled state, so 

\*abe) = (1a ® Ube) ^(l 00 > + I 11 )) ® \ E )- ( 2 ) 

Eve's unitary operation acting on the qubit going to Bob and her fixed ancillary 
system spans a two-dimensional subspace of TLb ® "He- It w &s shown in Ref. 
[T5] that there exist local bases |0'), |1') and |0), |1) for Bob and |0), |1) for Eve 
such that 

U B e\0')\E) = sina|01) +cosa|10) 

Ube\1')\E) = cos/3|00) +sin/3|ll), (3) 

where < a, (3 < tt/2. Using the fact that V®V*\<I> + ) = |$+), VU e SU(2), 
we can take on Bob's space the basis in the r.h.s. of Eq. (J2J) to be the same as in 
the l.h.s. of Eq. J2J. It follows that all the states (J2J) can be easily parametrized 
as 

\^abe) = -^(sinalOOl) +cosa|010) + cos/3|100) + sm/3|lll)), (4) 
V2 

i.e. they are completely specified by two angles, up to local unitary transforma- 
tions. 

The state shared by Alice and Bob is pab = Tr^d^ abe)(^abe\)- For any 
two-qubit state, the maximal violation B of the CHSH inequality |T7] reads 
B = \J\\ + Af, where the local bound is put at one [T%] . The Ai,2 are the 
two largest (in modulus) eigenvalues of the 3x3 correlation matrix R{p) whose 
elements are (R(p))ij = Tr((Ti(3crj p) where i,j = 1, 2, 3 and <7j denote the Pauli 
matrices. For the state pab one finds 

/cos(a-/3) \ 

R(PAB) = cos(a + /3) . (5) 

\ - cos(a + (3) cos(a - (3) J 

Note that \R XX \ > \R yy \ > \R ZZ \, whence B = (R 2 XX + i?^) 1/2 • After some 
simple algebra one finds that 

B > 1 <$=> < a, (3 < -, or - < a, (3 < -. (6) 
- - 4' 4~ 2 
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Now, let us see how the state pab can be used for cryptography. The honest 
partners measure in the local bases that are maximally correlated. That is (see 
Eq. JSJ), Alice and Bob both measure in the x basis. Their measurement results 
are denoted by ±, and the corresponding states by |±) = (|0) ± |l))\/2. Since 
Alice's state is completely random, pa(+) — Pa{—) = 1/2. Although Bob's 
state is different from 1/2, we also have that pb(+) = Pb(-) = 1/2. Then 
I(A : B) = Ib{R X x) where lb is the binary mutual entropy 

h{x) = l + — log ^_j + _] Qg ^_j. (7) 

Note that when < x\,x 2 < 1, h{xi) > Ib{%2) x\ > #2- 
Eve's states, depending on Alice and Bob's results, read: 

|e~++) 

\e+-) 

|e__) 

the norm of the states being the probability of any event, i.e. p (00) = p (11) = 
(l+R xx )/4 andp (01) = p (10) = (l-i? ra )/4. In the following, the tilde denotes 
non-normalized states. If Eve wants to acquire information about Alice's result, 
she has to distinguish between the two states pi — 2(|ej+)(ej+| + | ){Si_ | ) , 
where i = +, — . In this case, the measurement maximizing her information is 
known (actually, it also minimizes her error probability) 19 , having I (A : E) = 
h (sin(a + /?)). Therefore, Iab > Iae when R xx = cos(a — fi) > sin(a + /3), and 
then 

I(A :B)>I{A:E) <S=!> B > 1. (9) 

It is interesting to compute the information that Eve has about Bob's symbol. 
Using the same techniques as above for the states pi = 2(|e+j)(e+j| + |e_i)(e_i|) 
where i = +, — , one can see that I(B : E) — /{.(sinacosa + sin (3 cos /3). Note 
that I {A : B) > I(B : E) for all the values of a and (3 but (3 = ir/2 - a, 
where the two quantities are equal 1201 • This means that the honest partners 
can apply a reverse reconciliation protocol, i.e. one-way error correction and 
privacy amplification from Bob to Alice, Va,/3, except for a set of attacks of 
zero measure ((3 = ir/2 — a). Eq. can now be extended to 

I(A : B) > max(/(A : E), I(B : E)) B > 1. (10) 

The entanglement properties of pab also give more insight into this result, 
since one can see that pab is entangled [21] for all the attacks (except when 
(3 = tt/2 — a). Therefore none of the one-qubit attacks is able to disentangle 
Alice and Bob. 
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((cos a + cos /3)|0) + (sina + sin/3)|l)) 
((— cosa + cos/3)|0) + (sina — sin/3)|l)) 
((cos a — cos /3)|0) + (sina — sin/3)|l)) 
(—(cos a + cos/3)|0) + (sina + sin/3)|l)) , 



(8) 



There is a standard way in which Eve can make her information about Alice 
and Bob symmetric, simply using the same one-qubit attack, Ube(o>, ft), and 
adding an extra ancillary qubit. This symmetric two-qubit attack is shown in 
figure n The resulting state for Alice and Bob is Bell-diagonal [23] and has the 
same correlations as above, i.e. the same R matrix (although pab has now full 
rank, while above its rank was equal to 2). Therefore, the expression for the 
CHSH violation and the information Alice-Bob has not changed. Concerning 
Eve, some simple and patient algebra shows that her four two-qubit states are 

|e++) = — ^ ((cosa + cos/3)|0) + (sina + sin/3)|l)) <g> |+) 
2v 2 

|e+_) = — ^= ((-cos a + cosft)\0) + (sina - sin/3)|l)) <g> |-) 
2v 2 



e— 



((cos a — cos/3)|0) + (sin a — sin ® 



2V2 



\e ) = — -= (-(cosa + cos/3)|0) + (sin a + sin/3)|l)) ® |+), (11) 

2v 2 

Now, it is easy to understand the role played by the second qubit. In the first 
qubit we have the same information as above, so I(A : E) has not changed. 
From the second qubit Eve knows in a deterministic way whether Alice and 
Bob symbol coincide. This allows her to use the knowledge on Alice's symbol 
for guessing Bob's, and she now has I(B : E) = I (A : E). Thus, for this family 
of attacks 



I(A : B) > mm(I(A : E),I(B : E)) = I (A : E) = I(B : E) B > 1. 

(12) 

Since the present attack is symmetric, it is not important which of the honest 
partners starts the one-way error correction and privacy amplification processes. 

In conclusion: for all individual attacks with just one qubit, the link be- 
tween sceurity and BI is given by l|10|) . For the two qubit attacks built from the 
one-qubit ones through the scheme of Fig. ^ the link is provided by (|12fl . The 
optimal individual eavesdropping on the BB84 protocol belongs to this family 
of two-qubit attacks 0. But we would like to stress here that our results are 
independent of any considered protocol. Indeed, we have studied the relation 
between Bell violation and security for a family of states obtained after eaves- 
dropping on half of a maximally two-qubit entangled state. We have shown that 
the violation of the CHSH guarantees the existence of projective measurements 
whose results allow the honest partners to establish a key with efficiency |24) . 
As expected, these measurements are related to the bases that appear in the 
violated CHSH inequality. 
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Figure 1: General scheme for modifying the initial one-qubit attack, specified 
by U BE (a,(3), where I(A : B) > I(B : E) and I(A : E) > I(B : E), into a 
symmetric two-qubit attack, where I(A : E) is the same but now I(B : E) = 
I(A : E). 

4 Conclusions 

We have discussed the main connections between Bell's inequalities and the 
usefulness of entanglement in quantum information processing. In all the cases 
that have been considered, a state that violates a Bell's inequality is useful for 
quantum information processing; in the case of cryptography, it even leads to 
efficient (one-way) secret-key extraction. Bell's inequalities appear as detectors 
of "efficient entanglement". 

The precise link between entanglement, "useful" or "efficient" entanglement, 
and non-locality remains however elusive, in spite of all these clarifications. 
On the one hand, we are just now beginning to tackle in a fruitful way the 
hard task of classifying all the Bell's inequalities j25J- On the other hand, our 
understanding of entanglement has been recently improved by a remarkable 
result 1201 by the Horodeckis and Oppenheim, who have shown that a secret 
key can be extracted from some bound entangled states: ultimately, we may 
discover that any form of entanglement is "useful" for something. This situation 
promises still a lot of work to do for the future. 
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